OpenC3 COSMOS uses clear text storage of password/token (`GHSL-2024-129`)
概要
OpenC3 COSMOS uses clear text storage of password/token (GHSL-2024-129)
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. OpenC3 COSMOS stores the password of a user unencrypted in the LocalStorage of a web browser. This makes the user password susceptible to exfiltration via Cross-site scripting (see GHSL-2024-128). This vulnerability is fixed in 5.19.0. This only affects Open Source edition, and not OpenC3 COSMOS Enterprise Edition.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- advisory securitylab.github.com
- patch github.com